Phase-1 SSO/app-passwords for jellyfin needs the ldapauth and sso plugins
present without relying on the in-app catalog (which the plugins-baked PVC
would otherwise let drift). Pin the newest release of each whose targetAbi
is <= the pinned server version (10.11.6) and let the image own the version.
- Add a plugins build stage that downloads, sha256-verifies (matching each
release's published .sha256), and unpacks the plugin zips into versioned
dirs baked at /usr/share/jellyfin/plugins-baked.
- LDAP Authentication 22.0.0.0 (targetAbi 10.11.2.0; v23 needs 10.11.9).
- SSO Authentication 4.0.0.4 (targetAbi 10.11.0.0).
- Add docker-entrypoint.sh that syncs baked plugin dirs into /config/plugins
on every start, removing any stale versioned dir of the same plugin so the
image controls the version across restarts; preserves plugin configurations.
- Point ENTRYPOINT at the new script.
The runtime image based on aspnet:10.0 provides only .NET 10.x, but the
publish step builds framework-dependent against SDK 9.0, so the app requires
Microsoft.NETCore.App 9.0.0 and crashes on start under 10.x.
Pin the runtime base to aspnet:9.0 to match the SDK 9.0 publish.
Point the release docker step at the custom
artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx
image, which bakes artifactapi's internal Vault CA into
/etc/docker/certs.d/<registry>/ca.crt.
- Swap the docker step image from upstream woodpeckerci/plugin-docker-buildx
to the CA-baked custom image.
- Drop the separate ca-trust step (and its almalinux9-base dependency) that
staged the CA into the workspace.
- Repoint buildkit_config ca= at the in-image baked CA path so the buildx
docker-container builder still hands the CA to buildkitd for the push.
The v0.1.0 release pipeline built the runtime image fine but failed the
push to artifactapi.k8s.syd1.au.unkin.net/docker-internal with a TLS
x509 unknown-authority error: buildkit did not trust artifactapi's
Vault-signed cert.
Stage the internal CA into the shared workspace via the almalinux9-base
image (already trusts the unkin CA; same image the RPM release pipelines
use to reach artifactapi over HTTPS) and point the docker-buildx plugin
at it through buildkit_config. buildx copies the referenced CA into the
buildkitd container at builder-create time, so the push handshake now
verifies. No credentials needed: anonymous push to docker-internal is
allowed for trusted clients.
The pinned jellyfin-ha-src fork sets global.json sdk 9.0.0 (rollForward
latestMinor), so the publish steps in build.yaml and docker.yaml must run
on the .NET 9 SDK. They referenced sdk:10.0, which fails the pinned build.
Repoint both publish steps to mcr.microsoft.com/dotnet/sdk:9.0.
Why:
- The build should pull from our own source fork so local HA patches can be
carried and pinned, rather than cloning the upstream GitHub tree directly.
How:
- Point the clone URL in the Makefile and both Woodpecker pipelines at
https://git.unkin.net/unkin/jellyfin-ha-src.git.
- Keep UPSTREAM_REF at d4f9c12c22d3a640f3b0a3622b23b8cd01d044ad, which is the
seeded fork main, so the produced image is byte-identical for now; the
feature bump is a later change.
Hard switch of the docker push target from the Gitea registry to the
artifactapi local docker registry (docker-internal); the Gitea VM and its
registry are being retired. Drops the droneci/DRONECI_PASSWORD creds since
artifactapi accepts unauthenticated in-cluster pushes. Also repoints the Makefile IMAGE and README image paths.
Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
unkin-agent
benvin
unkin-agent
unkinben
gitadmin